Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-34335MEDIUMORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login page.EPSS 0.3%CVE-2024-52486MEDIUMWordPress Elementor Portfolio Builder plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-48254MEDIUMThe vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted UEPSS 0.3%CVE-2024-13858MEDIUMBuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'EPSS 0.3%CVE-2024-43163HIGHWordPress ParcelPanel plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-40322CRITICALSiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCEEPSS 0.3%CVE-2025-41087MEDIUMCross-Site Scripting (XSS) stored in Taclia's web applicationEPSS 0.3%CVE-2025-43786MEDIUMEnumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 throuEPSS 0.3%CVE-2026-113493MEDIUMGeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width AttributeEPSS 0.3%CVE-2024-49656HIGHWordPress DocumentPress plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35321MEDIUMMyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.EPSS 0.3%CVE-2026-77072HIGHn8n before 1.123.69 Stored XSS via Form Completion PageEPSS 0.3%CVE-2025-9921MEDIUMcode-projects POS Pharmacy System products.php cross site scriptingEPSS 0.3%CVE-2024-13733MEDIUMSKT Blocks – Gutenberg based Page Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-0787MEDIUMESAFENET CDG appDetail.jsp cross site scriptingEPSS 0.3%CVE-2023-37539HIGHHCL Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49662HIGHWordPress Simple Load More plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2934MEDIUMYiFang CMS Extended Management D_friendLinkGroup.php update cross site scriptingEPSS 0.3%CVE-2025-9106MEDIUMPortabilis i-Diario Informações Adicionais /planos-de-ensino-por-disciplina cross site scriptingEPSS 0.3%CVE-2024-42335MEDIUM7Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%